v0.10.0

Alteryx One authentication GA. This is the first release where the full first-login flow (email OTP → workspace OIDC → 30-day PAT) and the Alteryx One API surface have been through a security and correctness red-team, with all blocking findings fixed and pinned by tests.

Why this is a minor bump

v0.9.x landed the pure-HTTP first-login flow and a wave of API surface fixes. v0.10.0 is the vetted cut: the auth flow and workspace model are now hardened, the secret handling is reviewed, and the new behavior is regression-tested (288 tests, up from 255).

Security

• Inline-secret warning on auth login. On a host with no OS keyring, the 30-day PAT is stored as plaintext in the profile YAML. This was previously silent; auth login now prints a warning (and surfaces inline_secret_fields in the JSON envelope), matching the onboarding path. Configure a keyring backend to avoid plaintext at rest.
• Redacted preflight errors. The workspace preflight error path no longer interpolates a raw response body into the error chain; the body preview is run through the redactor, matching the adjacent parse-failure branch.
• Stronger redactor. The secret redactor now masks the field names this flow actually emits — tokenValue, local-auth-workspace, x-csrf-token, passcode, passcodeReferenceId, secret — and bare JWT-shaped tokens (eyJ…), not just Bearer <token> and a fixed key allowlist.

Workspace model — the token is the workspace

A key fact, verified live: the Alteryx One PAT is workspace-bound. The x-alteryx-workspace-gid request header is ignored by the server; the token alone determines which workspace you are operating in. The CLI now matches that reality:

• workspace people and workspace admins are argless. The old required --workspace-id was silently ignored — passing one workspace id while the profile pointed at another returned the other workspace’s members with no error. Removed.
• workspace switch --workspace-id <id> (new) selects an already-authenticated workspace credential from the profile and makes it active instantly — no re-auth when you have already logged into that workspace. If you have not, it tells you to run auth login for it. Switching workspaces is now a first-class, seamless operation.
• workspace invite-users, remove-user, suspend-users, unsuspend-users, transfer, transfer-assets now reject an explicit --workspace-id that does not match the active workspace, rather than putting one id in the request path while the token authorizes a different workspace. Omit the flag to use the active workspace.

Correctness

• connections connector-metadata template: when the connection type cannot be confidently inferred from the connector category, the template now emits a <jdbc|remotefile|…> placeholder with a _note, instead of silently guessing remotefile for every non-relational connector. credentialType notes when multiple choices existed.
• job-groups list: synthesized display names now disambiguate multiple runs of the same flow — flow-{flowId} ({id}) or flow-{flowId} @ {createdAt} — instead of collapsing every run to one flow-{flowId} row.
• apply_env_fallbacks: restored uniform gap-fill precedence (an env var fills only an absent/empty profile value) for base_url, oauth_client_id, client_secret, and token_endpoint_url, matching the in-code “last-resort fallback” contract. No behavior change when no env vars are set.

Tests

33 new deterministic tests, none requiring live credentials:

• Panic-regression guards for the four commands renamed to --output-file (flows export, server system-info, server runtime-settings, tools workspace init) — assert the global --output json flag no longer triggers the clap downcast panic.
• Unit coverage for synthesize_job_group_names, the connection-template builder (build_connection_template), resolve_workspace_id, and the One-only-profile guard.

Known limitations (unchanged from v0.9.14)

• A cluster of surfaces returns AccessControlException (403) under the workspace-bearer PAT: flows permissions-get, flows parameters, platform role list, connections dry-run. Resolving requires a UI-minted token or broader OAuth scopes at the token-mint step.
• flows validate and webhook-flow-tasks return 404 (not present on non-enterprise tiers). Billing, plans, and scheduling remain enterprise-tier-gated.

Validation

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run --workspace --locked — 288 passed, 24 skipped (live-auth-gated)
• Live smoke checks against a live test workspace